EX294 Practice Test 4 — 25 Questions

Question 1

An Ansible playbook retrieves a list of dictionaries from an API. Each dictionary has keys 'name', 'status', and 'zone'. The playbook needs to filter out entries where 'status' is 'inactive' and then extract only the 'name' values. Which THREE of the following combinations of filters and loops would achieve this?

Accepted Answer

{{ data | rejectattr('status', 'equalto', 'inactive') | map(attribute='name') | list }}. Option A is correct because `rejectattr` filters out items where `status` equals 'inactive', and then `map(attribute='name')` extracts the `name` values from the remaining dictionaries. The `| list` filter converts the result into a list. This is a standard Jinja2 filter chain in Ansible for filtering and transforming data.

Answer

{{ data | rejectattr('status', 'equalto', 'inactive') | extract('name') | list }}

Answer

{{ data | selectattr('status != inactive') | map(attribute='name') | list }}

Question 2

A systems administrator needs to run a playbook that installs packages on a group of managed nodes. The playbook should run only on nodes that are part of the 'web_servers' group in the inventory. Which approach is best practice?

Accepted Answer

Set 'hosts: web_servers' in the play.. Option A is correct because setting 'hosts: web_servers' in the play directly targets only the nodes in that inventory group, which is the simplest and most maintainable approach. This follows Ansible's best practice of declaring the target group explicitly in the playbook rather than relying on runtime flags or conditional logic, ensuring the playbook's intent is clear and portable.

Answer

Set 'hosts: all' and use '--limit web_servers' when running ansible-playbook.

Answer

Set 'hosts: localhost' and delegate tasks to web_servers.

Answer

Set 'hosts: all' and use a 'when' condition to check if the node is in the web_servers group.

Question 3

Refer to the exhibit. The playbook uses the 'yum' module to install 'httpd' on a RHEL 8 system. Which of the following is the most likely cause of the failure?

Accepted Answer

The AppStream repository is not enabled on the target host.. On RHEL 8, the `yum` command is a symbolic link to `dnf`, and the `yum` Ansible module internally uses `dnf` as the backend. The most common cause of failure when installing a package like `httpd` on RHEL 8 is that the AppStream repository (which contains `httpd`) is not enabled or available on the target host. Without an enabled repository containing the package, the module cannot resolve and install it, leading to a failure.

Answer

The 'yum' module is deprecated for RHEL 8; must use 'dnf'.

Answer

The remote host does not have subscription-manager access.

Answer

The package name is misspelled; it should be 'apache2'.

Question 4

An Ansible playbook needs to generate a list of IP addresses from a range 192.168.1.10 to 192.168.1.20. Which filter should be used in a Jinja2 template?

Accepted Answer

{{ '192.168.1.10-20' | ipaddr('range_include') }}. Option B is correct because the `ipaddr` filter with the `'range_include'` parameter generates a list of all IP addresses within a specified range, including both endpoints. In this case, `'192.168.1.10-20' | ipaddr('range_include')` produces a list from 192.168.1.10 through 192.168.1.20, which is exactly what the playbook needs to generate.

Answer

Answer

Answer

Question 5

A team develops an Ansible collection and wants to distribute it internally. They have a private Automation Hub. Which approach best ensures that collection dependencies from external sources are also available?

Accepted Answer

Define a requirements.yml in the execution environment that references both the private hub and external sources. Option B is correct because defining a `requirements.yml` in the execution environment allows you to specify collections from both the private Automation Hub and external sources (e.g., Ansible Galaxy). When building the execution environment, `ansible-builder` processes this file and resolves dependencies from the listed sources, ensuring all required collections are bundled into the container image. This approach automates dependency management and avoids manual installation or repository bloat.

Answer

Manually install each dependency on the control node

Answer

Include all dependencies directly in the collection's repository

Answer

Use ansible-galaxy collection download and then upload to private hub

Question 6

An admin attempts to build an execution environment using the exhibited files. The build fails with an error about incompatible Python dependency. What is the most likely cause?

Accepted Answer

The Python requirements.txt tries to install a version of Ansible that conflicts with the version in the base image.. The build fails because the Python `requirements.txt` file attempts to install a version of Ansible that conflicts with the version already present in the base image `ee-minimal-rhel8`. Execution environments are designed to include a specific Ansible version in the base image; adding a different version via pip creates a dependency conflict that breaks the build.

Answer

The execution-environment.yml file uses incorrect syntax for the 'dependencies' section.

Answer

The collections in requirements.yml are not fully qualified.

Answer

The base image 'ee-minimal-rhel8' is not a valid execution environment base image.

Question 7

An Ansible automation engineer is developing a role that manages a microservice. The role needs to include conditional tasks based on whether a variable `microservice_version` is defined. If defined, it should use that version; otherwise, it should default to `latest`. Which of the following is the most efficient and idiomatic way to implement this default value within the role?

Accepted Answer

In the task: `image: "myimage:{{ microservice_version | default('latest') }}"`. Option D is correct because it uses the `default` filter directly in the task to set a fallback value for `microservice_version` when it is undefined. This is the most efficient and idiomatic approach in Ansible, as it avoids modifying role defaults or introducing extra variables, and it handles the conditional logic inline without unnecessary complexity.

Answer

In `defaults/main.yml`: `microservice_version: latest` and reference `{{ microservice_version }}` in the task.

Answer

In the task: `image: "myimage:{{ microservice_version }}"` and use `| mandatory` to fail if undefined.

Answer

In the task: `vars: microservice_version: "{{ microservice_version | default('latest') }}"`

Question 8

Which TWO statements are true about Ansible content collections?

Accepted Answer

Collections can be installed from Automation Hub, Galaxy, or a Git repository.. Option A is correct because Ansible collections can be installed from multiple sources: Automation Hub (a Red Hat curated repository), Galaxy (the community repository), or directly from a Git repository using the `ansible-galaxy collection install` command with a Git URL. This flexibility allows users to leverage curated, community, or custom collections as needed.

Answer

Collections cannot contain playbooks.

Answer

A role stored in a collection can be referenced by its short name without the collection prefix.

Answer

Execution environments are required to use collections.

Question 9

An organization has multiple automation controller clusters spread across different geographic regions. The security policy requires that job artifacts (such as logs and assets) must remain in the region where the job ran. Which THREE configurations support this requirement? (Choose exactly three.)

Accepted Answer

Disable the 'Enable remote logging' option in the controller configuration for each cluster.. Option A is correct because disabling 'Enable remote logging' in the controller configuration ensures that job artifacts (logs, assets) are stored locally on the controller's filesystem rather than being forwarded to an external logging server. This directly enforces the regional data residency requirement by preventing artifacts from leaving the geographic region where the controller cluster resides.

Answer

Use a custom execution environment that writes artifacts to a network share.

Answer

Configure automation mesh to route jobs to the nearest execution node.

Question 10

An Ansible Engineer is planning a rolling update for a web application deployed across 10 nodes. The playbook uses the 'delegate_to' directive to manage load balancer health checks. Which of the following best describes the recommended approach to minimize downtime?

Accepted Answer

Use 'serial: 1' and delegate load balancer disable/enable tasks to localhost, ensuring each node is taken out of rotation before updating.. Option A is correct because using 'serial: 1' ensures that only one node is updated at a time, and delegating load balancer disable/enable tasks to localhost (or the Ansible control node) allows the playbook to interact with the load balancer API to remove the node from the pool before the update and re-add it after. This minimizes downtime by ensuring traffic is not sent to a node being updated, while other nodes continue serving requests.

Answer

Run the update playbook with 'serial: 10' to update all nodes at once, then run a separate playbook to update the load balancer.

Answer

Run the update on each node manually using 'ansible-playbook --limit' and skip load balancer management to save time.

Answer

Use 'strategy: free' to allow nodes to update independently without controlling the load balancer.

Question 11

Match each firewall zone to its default behavior.

Accepted Answer

public: Rejects incoming traffic except for explicitly allowed services.. Common firewalld zones include public (default deny), trusted (allow all), external (NAT with limited inbound), dmz (limited inbound for public servers), internal (trusted but filtered), and drop (silent discard). Common confusions involve swapping the behaviors of public and trusted, or misunderstanding dmz as fully blocking instead of selectively allowing.

Answer

internal: Allows all incoming traffic from any source.

Answer

dmz: Drops all incoming traffic.

Question 12

Match each Ansible playbook directive to its purpose.

Accepted Answer

hosts: Defines the managed hosts or groups. Correct matches: 'hosts' specifies target hosts, 'tasks' lists actions, 'become' enables privilege escalation. Common confusion includes swapping hosts and tasks.

Answer

hosts: Defines variables used throughout the playbook

Answer

tasks: Defines the target hosts or groups

Question 13

When using the 'uri' module to interact with a REST API in Ansible, which TWO of the following statements about error handling and response parsing are correct?

Accepted Answer

To access the response body, use the 'body' key of the registered variable and then parse it with a filter like 'json_query'.. Option B is correct because when you register the result of an `uri` module call, the response body is stored under the `body` key of the registered variable. To extract or filter data from that JSON body, you can use the `json_query` filter (which relies on jmespath) to parse and query the JSON structure. This is the standard approach for accessing and manipulating API response data in Ansible.

Answer

The 'follow_redirects' parameter must be set to 'all' to handle HTTP 4xx and 5xx errors gracefully.

Answer

The 'failed_when' condition can inspect the HTTP response before the request is sent.

Answer

The 'register' keyword automatically parses JSON responses into Ansible variables.

Question 14

Which TWO statements about Ansible roles are true?

Accepted Answer

A role can include tasks, handlers, variables, templates, and files.. Option A is correct because Ansible roles are designed to organize automation content into a standardized directory structure that can include tasks, handlers, variables, templates, and files. This modular structure allows for better code reuse and maintainability, as each component is stored in its own subdirectory within the role.

Answer

Roles are defined directly inside a playbook using the 'roles' keyword.

Answer

Roles can only be invoked using the 'include_role' module.

Answer

Variables defined in a role's vars/main.yml cannot be overridden by playbook variables.

Question 15

A team runs the playbook shown in the exhibit. They notice that during the update, some requests are still being sent to servers that have been disabled. What is the most likely cause?

Accepted Answer

The 'serial: 2' setting allows two hosts to be disabled simultaneously, and the load balancer may not have drained connections.. Option B is correct because the `serial: 2` setting causes Ansible to update two hosts at a time. When a host is disabled in the load balancer, existing connections may not be fully drained before the next batch of hosts is updated, allowing traffic to still reach disabled servers. The load balancer needs time to drain active sessions, and a serial batch of 2 can overlap with that drain window.

Answer

The disable task should use 'state: maintenance' instead of 'state: disabled'.

Answer

The 'delegate_to' should be set to localhost, not lb01.

Answer

The 'serial' keyword is incorrectly used as a global variable.

Question 16

Which TWO of the following are valid methods to manage credentials in Ansible Tower?

Accepted Answer

Integrate with an external secrets management system using a credential lookup plugin.. Option A is correct because Ansible Tower (now Red Hat Ansible Automation Platform) supports integration with external secrets management systems like HashiCorp Vault, CyberArk, or Azure Key Vault via credential lookup plugins. This allows Tower to retrieve secrets dynamically at runtime without storing them in the Tower database, aligning with security best practices.

Answer

Export credentials from the Ansible Tower API in plain-text.

Answer

Use machine credentials with an SSH key that has a passphrase.

Answer

Store credentials in plain-text in the Ansible Tower database.

Question 17

Which TWO statements about Ansible roles are correct?

Accepted Answer

Roles must follow a specific directory structure.. Option A is correct because Ansible roles enforce a specific directory structure (e.g., tasks/, handlers/, templates/, files/, vars/, defaults/, meta/, and library/) to organize automation content. This structure is mandatory for Ansible to correctly locate and load role components during playbook execution.

Answer

Ansible Galaxy is a continuous integration tool for testing roles.

Answer

Role dependencies must be defined in a file named dependencies.yml.

Answer

Role names must have a .role extension.

Question 18

An administrator wants to use a custom inventory script to dynamically generate hosts in Ansible Tower. Which of the following is a valid approach to manage credentials for accessing the script's API?

Accepted Answer

Define environment variables in the job template that references the inventory script, and use a credential type that injects those variables.. Option A is correct because Ansible Tower (now Red Hat Ansible Automation Platform) allows custom credential types to inject environment variables into job runs. When a custom inventory script requires API authentication, you can define a credential type with injector configuration that sets environment variables (e.g., API_TOKEN, API_USER), then attach that credential to the job template. This keeps secrets out of scripts and repositories, following security best practices.

Answer

Attach the credential directly to the inventory script in the Ansible Tower UI.

Answer

Store the API token in a file within the project repository and source it in the script.

Answer

Embed the API token within the inventory script's JSON output.

Question 19

A systems administrator needs to securely store a database password for use in an Ansible playbook. The password should be encrypted at rest and decrypted only at runtime when the playbook is executed. Which approach should the administrator take?

Accepted Answer

Use the ansible-vault encrypt_string command to encrypt the password and store it in a variables file.. Option B is correct because `ansible-vault encrypt_string` encrypts the password at rest using AES-256, storing it as a ciphertext string in a variables file. At runtime, when the playbook is executed with `--ask-vault-pass` or a vault password file, Ansible decrypts the value transparently, ensuring the plaintext password is never written to disk or logs.

Answer

Store the password as a plain text variable in the playbook and use the no_log: yes directive to prevent logging.

Answer

Store the password in an unprotected external file and reference it with include_vars.

Answer

Save the password in an environment variable and access it via lookup('env','DB_PASS').

Question 20

An organization uses a proprietary API service that requires token-based authentication with a base64-encoded payload including username, password, and tenant ID. The administrator wants to create a custom credential type in automation controller so that users can input these three values separately, and the playbook receives the final token. Which input configuration fields should be defined?

Accepted Answer

Three separate text fields (username, password, tenant ID) with a custom injector template that concatenates and base64-encodes them.. Option A is correct because automation controller custom credential types allow defining multiple input fields (username, password, tenant ID) and a custom injector template that can concatenate and base64-encode these values into a single token. The injector template uses Jinja2 syntax to combine the inputs and apply the `b64encode` filter, so the playbook receives the final base64-encoded token as a single credential variable.

Answer

One text field for the token, and inject it as an environment variable.

Answer

Two fields: username and password, and use a lookup plugin to fetch tenant ID.

Answer

Create a single multiline text field where users paste the base64 string.